Thanks for reporting this.
This is indeed an old domain, and the CNAME record seems to have outlived the domain.
It has been removed, and external mails should get flagged by SPF again.
Thanks for the report.
Deleted the old CNAME that outlived the domain.
External mails should get rejected once again now.